lowkernelverified ✓rollback-safe
Disable hfsplus kernel module
kmod-disable-hfsplus · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The hfsplus filesystem type is the Apple Mac OS Extended filesystem, rarely needed on Linux and an unnecessary kernel attack surface.
Rationale
Removing support for unneeded filesystem types reduces the local attack surface. If this filesystem type is not needed, it should not be loadable.
Check → Remediate
Checkkernel_module_state
- name:
- hfsplus
- state:
- blacklisted
Remediatekernel_module_disable
- name:
- hfsplus
Framework references
CIS
rhel8 1.1.1.4rhel9 1.1.1.4rhel10 1.1.1.4ubuntu22 1.1.1.4ubuntu24 1.1.1.4
NIST 800-53
CM-7
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:check
#kernel-module#attack-surface#cis